Japan Security Analyst Conference 2022
(Opening Talk)

Looking back on theincidents in 2021
JPCERT Coordination Center
Incident Response Group
January 27th, 2022
Takayoshi SHIIGI

Two Major Attack Types

Targeted Widespread(Attack aimed to steal
confidentialinformation)

1

Copyright ©2022 JPCERT/CC All rights reserved.

(Attack aimed tosteal money)

Targeted Attack

2

Copyright ©2022 JPCERT/CC All rights reserved.

LODEINFO

3

Copyright ©2022 JPCERT/CC All rights reserved.

Version History
2019/12-2020/12

2021/01-/02

v0.1.2-v0.4.6

v0.4.82021/01v0.4.74(2021/11v0.5.6)

Copyright ©2022 JPCERT/CC All rights reserved.

2021/04-/05

v0.4.9Change in Launch Method
DLL side Loading(v0.3.x)

2. Create&Execute

1. Create

3. Load

Legitimate file
5

LODEINFO

Copyright ©2022 JPCERT/CC All rights reserved.

DLL side loading
Via LOLBAS(v0.4.x)

Execute: rundll32.exe advpack.dll,RegisterOCX<path to executable file>

2. Create&Execute

1. Create

3. Load

Legitimate file

LODEINFO

Changes in Commands
v0.4.6•cd, ls•send, recv
•cat•memory•kill•ver•command•print•rm•ransom•keylog•mv, cp, mkdir•ps, pkill

v0.4.7-v0.4.9•cd, ls•send, recv
•cat•memory•kill•ver•command•print•rm•ransom•keylog•mv, cp, mkdir•ps, pkill•cd, ls•send, recv
•cat•memory•kill•ver•command•print•rm•ransom•keylog•mv, cp, mkdir•ps, pkill•comc•autorun•(config)

6

Copyright ©2022 JPCERT/CC All rights reserved.

v0.5.6( ): The commands in brackets havenot been implemented but just addedBlackTech7Copyright ©2022 JPCERT/CC All rights reserved.

Gh0stTimes (similarity to Gh0stRAT)

8

Gh0stTimes(CFileManager)

Copyright ©2022 JPCERT/CC All rights reserved.

Gh0stRAT(CFileManager)

Panel for Gh0stRAT(Times)

9

Copyright ©2022 JPCERT/CC All rights reserved.

Widespread Attack

10

Copyright ©2022 JPCERT/CC All rights reserved.

Emotet11

Copyright ©2022 JPCERT/CC All rights reserved.

Emotet Takedown

12

Copyright ©2022 JPCERT/CC All rights reserved.

Emotet Restarts (Multiple updates to our blog )13

Copyright ©2022 JPCERT/CC All rights reserved.

Ransomware Attackwith Penetration
14

Copyright ©2022 JPCERT/CC All rights reserved.

Sample of Ransomware Reported to JPCERT/CC
Magniber

Ryuk

EikingSnatchHive

Medusalocker

AvaddonLockbit

Ragnar Locker
15

Copyright ©2022 JPCERT/CC All rights reserved.

AgeLocker

AvosLocker

Publication(FAQ)

16

Copyright ©2022 JPCERT/CC All rights reserved.

Attack Exploiting XSS
Vulnerability
inE-commerce Websites
17

Copyright ©2022 JPCERT/CC All rights reserved.

Attack Overview

18

Copyright ©2022 JPCERT/CC All rights reserved.

Stealing Administrator’s Account Information

Malicious order exploiting XSS vulnerability

Information stealing JavaScript code
19

Copyright ©2022 JPCERT/CC All rights reserved.

Stealing Credit Card Information

Flow of attack

20

Copyright ©2022 JPCERT/CC All rights reserved.

Information stealing JavaScript code

JavaScript code sending credit card information

Attack Exploiting
Apache Log4j
Vulnerability(CVE-2021-44228)
21

Copyright ©2022 JPCERT/CC All rights reserved.

Attack Scenario
Send malicious string${jndi:ldap://<URL for malicious Java code>}

System coded by JavaLog4j

Attacker

Lookup functionInternet
malicious Java code22

Download（via JNDI）

Copyright ©2022 JPCERT/CC All rights reserved.

JavaExecute
malicious code

Log

Attack Activity

23

Observation of scan activities exploiting Apache Log4j vulnerability(Source: JPCERT/CC Honeypot: Dec 10th, 2021〜Jan 19th, 2022)

Copyright ©2022 JPCERT/CC All rights reserved.

Analysis Tool(Public project)
24

Copyright ©2022 JPCERT/CC All rights reserved.

JPCERT/CC Yara Rule (Just Released!)25

8 categories

Copyright ©2022 JPCERT/CC All rights reserved.

135 rules

Lucky Visitor Scam26Copyright ©2022 JPCERT/CC All rights reserved.

Lucky-Visitor-Scam-IoC

Monitoring C2 servers automatically for Lucky visitor scam
IoCs are published on GitHub (Updated everyday)

27

Copyright ©2022 JPCERT/CC All rights reserved.

How to enjoy
Online & 2Days
28

Copyright ©2022 JPCERT/CC All rights reserved.

1st Day(1/27): Conference Day
分類

A

29

タイトル

Ambiguous Black: The current state ofBlackTech’s arsenal

A

LuoYu: Continuous Espionage Activities
Targeting Japan with the new version of
WinDealer in 2021

A

Emotet vs EmoCheck: The Fight against
Emotet Developers

A/DCrazy Journey: Evolution of Smoky
CamouflageB

ma2tl: macOS Forensics Timeline
Generator Using mac_apt Analysis Results

Copyright ©2022 JPCERT/CC All rights reserved.

分類

タイトル

DAn Order of Magnitude Update

D

Combatting against malicious proxyservices in Japan

D

What We Can Do against the Chaotic
A41APT Campaign

D

Research on Unique Adversaries and its
Attack Tools Targeting Widespread CMS inJapan[A] Malware[B] Forensics[C] Incident analysis, response and attack
method[D] Threat trends and intelligence2nd Day(1/28): Workshop Day
分類

タイトル

W[B]An Introduction to macOS Forensics with Open Source Software

W[A/C]

YARA Pretty Darby: Hunt the Spider like a Champ[A] Malware[B] Forensics[C] Incident analysis, response and attack method[D] Threat trends and intelligence30

Copyright ©2022 JPCERT/CC All rights reserved.

Networking

Powered by
31

Copyright ©2022 JPCERT/CC All rights reserved.

Follow-up Event
Title: After JSAC2022
Delivery: Online
Date & Time: 2/18(Fri.) 16:00 - 17:00
Contents(tentative):
1.
2.
3.
4.
32

Best speaker award
Looking back on JSAC2022
Discussion of challenges for resent incident response
Towards JSAC2023

Copyright ©2022 JPCERT/CC All rights reserved.

Code of Conduct

33

https://jsac.jpcert.or.jp/en/coc.html

Copyright ©2022 JPCERT/CC All rights reserved.

Thank you!
34

Copyright ©2022 JPCERT/CC All rights reserved.